add generate-client.js script

deprecates keeping client.secret in config files (you'll get a WARN)

see #98